Resident Shield Alert
Accessed file is infected
application cannot be executed
File avgcsrvx.exe is infected
Almost immediately, a new window popped up with Antivirus System Pro Alert saying that there was an infection and starting a scan for viruses. It kept popping up no matter what I did, so I shut down the system, restarted, and ran the Malwarebytes program that I had already previously installed. This stopped the popups, but I believe that the computer is still infected.
Since I had just gone through a similar experience, although with a different infection, I decided to run some of the programs that I had run for my infection on her computer, and then to contact you if it did not clear up the infection.
Here are the programs that I ran, in the order listed with a quick summary of the results, let me know what information you want me to send from these:
Malwarebytes Antimalware - found and removed 3 infected files and stopped the popups using old definitions
Malwarebytes Antimalware - found and removed 2 more infected files after updating definitions
SUPERAntispyware - found and removed 38 infected files
RootRepeal - stopped on BSOD almost immediately
Dr.Web CureIt - found HOSTS file modified and quarantined it, found and quarantined/moved 9 objects
gmer - found 4 Attached devices
After this I tried RootRepeal again, at first, it just restarted Windows, so I deleted the file, and recopied it from my flash drive and ran it again, this time it found :
Program Version: Version 220.127.116.11
Windows Version: Windows XP SP3
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF00EE000 Size: 98304 File Visible: No Signed: -
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF9A5A000 Size: 8192 File Visible: No Signed: -
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEF98C000 Size: 49152 File Visible: No Signed: -
Status: Locked to the Windows API!
Editted @ 1:30 PM CT
I just found instructions for removing Antivirus System pro elsewhere on the site and tried removing using Rkill and Malwarebytes. Malwarebytes ran and reported no infections, but based on other scans, I'm not so sure! Please advise!
Edited by jimworzala, 16 November 2009 - 02:32 PM.